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Since 1984, various optical quantum key distribution (QKD) protocols have been proposed and 
examined. In all of them, the rate of secret key generation decays exponentially with distance. A 
natural and fundamental question is then whether there are yet-to-be discovered optical QKD pro¬ 
tocols (without quantum repeaters) that could circumvent this rate-distance tradeoff. This paper 
provides a major step towards answering this question. We show that the secret-key-agreement 
capacity of a lossy and noisy optical channel assisted by unlimited two-way public classical commu¬ 
nication is limited by an upper bound that is solely a function of the channel loss, regardless of how 
much optical power the protocol may use. Our result has major implications for understanding the 
secret-key-agreement capacity of optical channels—a long-standing open problem in optical quan¬ 
tum information theory—and strongly suggests a real need for quantum repeaters to perform QKD 
at high rates over long distances. 


The goal of quantum key distribution (QKD) is to gen¬ 
erate a shared secret key between two distant parties Al¬ 
ice and Bob, such that the key is perfectly secret from 
any eavesdropper, Eve. Since the invention of the BB84 
protocol [T], the theory and practice of QKD has come 
a long way. Various different QKD protocols have been 
proposed in the last three decades [5] , some of which are 
now turning from science into practical technologies li- 
[ 3 . Security of QKD has now been proven for many pro¬ 
tocols and under practical limitations such as a finite key 
length [51 [7]. 

It is well recognized that the key rates of all known 
QKD protocols (such as BB84 [T], E91 [5], CV-GG02 |5]) 
decay exponentially with distance. To obtain a large 
key rate across a long distance link, the link can be di¬ 
vided into many low-loss segments separated by trusted 
(physically-secured) relay nodes. Interestingly however, 
quantum mechanics permits building QKD protocols us¬ 
ing devices called quantum repeaters, which if supplied 
at the relay nodes, would make it unnecessary to physi¬ 
cally secure them, thus enabling long-distance high-rate 
QKD. 

Quantum repeater technology, in particular ones built 
using quantum memories, have been a subject of intense 
investigation in recent years unmi], but an operational 
demonstration of a quantum repeater has proven ex¬ 
tremely challenging and has yet to be conducted (note 
that some repeater protocols without quantum memory 
have been proposed recently niin], but their implemen¬ 
tation is still challenging). 

The natural question that thus arises, is whether there 
are yet-to-be-discovered optical QKD protocols that 
could circumvent the exponential rate-distance tradeoff 
of BB84 and transmit at high rates over long distances 
without the need for quantum repeaters. In this paper, 
we establish that it is not possible to do so. We employ 
information-theoretic techniques in order to establish our 


main result. 

The secret key agreement capacity of a quantum chan¬ 
nel is the highest rate (bits per channel use) at which a 
shared key can be reliably and securely generated using 
the channel many times in conjunction with unlimited 
two-way classical communication over an authenticated 
public channel. This paper establishes that, regardless of 
the QKD protocol used, a fundamental limit on the se¬ 
cret key agreement capacity of a lossy optical channel is 
given by an upper bound that is solely a function of the 
channel loss, i.e., independent of the transmit power. We 
show that the bound is nearly optimal at high loss, the 
regime relevant for practical QKD. We also compare our 
upper bound and the best-known achievable rate with 
the ideal BB84 and CV-GG02 protocols. We find that 
even though there is room for improvement over these 
protocols, there is essentially no gap in the rate-loss scal¬ 
ing. We thereby place on a firm foundation the need 
for quantum repeaters for high rate QKD over long dis¬ 
tances with no trusted relays. We note that the upper 
bound proved here is a so-called ‘weak converse’ upper 
bound, meaning that if the communication rate of any 
secret key agreement protocol exceeds this bound, then 
our theorem implies that its reliability and security can 
never be perfect, even in the asymptotic limit of many 
channel uses (we will also discuss the issue of a finite 
number of channel uses below and the Methods section). 

A generic point-to-point QKD protocol is illustrated in 
Fig.lH In the protocol, the sender Alice transmits over 
n independent uses of the quantum channel Af. The le¬ 
gitimate receiver Bob obtains the outputs of the channel 
uses. Note that Alice could send product or entangled 
states. They are also allowed unlimited two-way public 
classical communication over an authenticated channel, 
in order to generate shared secret key. The adversary 
Eve is assumed to be ‘all-powerful’: one who has ac¬ 
cess to the full environment of the Alice-to-Bob quan- 
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turn channel, the ‘maximal’ quantum system to which 
she can have access. Optically, this translates to Eve 
being able to collect every single photon that does not 
enter Bob’s receiver. Eve may also actively attack, for 
instance by injecting a quantum state into the channel. 
She has access to all the public classical communication 
between Alice and Bob. Finally, Eve is assumed to be 
able to store the quantum states she obtains over all n 
channel uses without any loss or degradation, and she 
can make any collective quantum measurement on those 
systems, in an attempt to learn the secret key. In the 
theory of QKD, one attributes all channel impairments 
(such as loss, noise, turbulence, detector imperfections) 
collectively measured by Alice and Bob during a channel- 
estimation step of the protocol, to adversarial actions of 
the worst case Eve with which the measured channel is 
‘consistent’ (even though in reality all those impairments 
may have been caused by non-adversarial natural phe¬ 
nomena). Alice and Bob then run a key generation pro¬ 
tocol aiming to generate secret key at a rate close to the 
secret key agreement capacity of that channel. It is hard 
in general to calculate this capacity precisely, and even 
more so to come up with protocols that can attain key 
rates close to that capacity. 

In this paper, we show a strong limitation on the secret 
key agreement capacity of a general memoryless quan¬ 
tum channel. More precisely, we provide a simple upper 
bound on the two-way assisted private capacity P 2 [N) of 
a quantum channel M. Note that the capacity for secret- 
key agreement using QKD as discussed above is equal to 
the capacity for private communication with unlimited 
public discussion, due to the one-time pad protocol. We 
first define a new quantity, the squashed entanglement 
of a quantum channel, and show that it is a simple up¬ 
per bound on P 2 {Af) for any quantum channel Af. We 
then apply it to the pure-loss optical channel with 
transmittance 77 S [0,1]. Channel loss is an important 
and measurable impairment both for free-space and fiber 
optical links, and is directly tied to the communication 
distance (for example, a low-loss fiber may have a loss of 
0.2 dBkm“^). Since any excess noise in the channel or 
detectors can only reduce the extractable key rate, our 
upper bound on P 2 {Afri) imposes a fundamental upper 
limit on the secret key rate of any point-to-point QKD 
protocol over a lossy optical channel not assisted by any 
quantum repeater. We will establish the following upper 
bound: 

P 2 {Afri) < log 2 ((l -I- 77)/(l — rj)) key bits per mode. (1) 

In the practical regime of high loss (77 ^ 1), we will 
argue that this upper bound is only a factor of two 
higher than the best known lower bound, P 2 {Afri) > 
log(l/(l — 77 )) [14]. We will also extend our upper bound 
to the more general scenario of QKD using a two-way 
quantum channel with unlimited public discussion, which 
was discussed recently in Ref. m- Finally, we will com- 


two-way classical communication 



FIG. 1: A generic point-to-point QKD protocol. Al¬ 
ice transmits quantum state via n forward uses of a quantum 
channel to Bob. They are also allowed to use unlimited for¬ 
ward and backward public classical communication over an 
authenticated classical channel. 


pare our upper bound and the best-known lower bound 
to the rate achievable by the BB84 and the CV-GG02 
protocols under best-case operating conditions as well as 
compare to the performance of these protocols under re¬ 
alistic operating conditions. 


Results 

Squashed entanglement. Before discussing our 
main results, we briefly review the squashed entangle¬ 
ment, which plays an important role in our work. The 
secret-key agreement capacity assisted by public com¬ 
munication was defined for a classical channel Py,z\x 
{X = Alice, Y = Bob, Z = Eve), independently by Mau¬ 
rer US], and Ahlswede and Csiszar m who proved lower 
and upper bounds on the capacity. Maurer and Wolf 
later introduced the intrinsic information I(X]Y],Z) = 
mm{l{X-Y\Z') : Px,Y,z,z' = Px,Y,zPz'\z}, and proved 
that this quantity optimized over all channel input distri¬ 
butions is a sharp upper bound on the secret key agree¬ 
ment capacity of Py,z\x [ IH ]- Leveraging strong par¬ 
allels discovered between secrecy and quantum coher¬ 
ence HMD, Ghristandl and Winter extended the in¬ 
trinsic information quantity to the realm of quantum 
information theory. They defined the squashed entan¬ 
glement Esq{A-,B)^ of a bipartite quantum state pab^ 
and proved it to be an upper bound on the rate at which 
two parties can distill maximally entangled (Bell) states 
(|0)|0) -I- |l)|l))/-\/2 from many copies of pab using lo¬ 
cal operations and classical communication (LOGG) |2]. 
Using a similar technique, the squashed entanglement 
was proved to upper bound the distillable secret key 
rate [531 HI] • The squashed entanglement of a bipartite 
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state pAB is defined as 

E,^{A-,B)^ = \ mi I{A-B\E'), (2) 

where I{A]B\E') = H{AE') + H{BE') - H{E') - 
H{ABE') is the conditional quantum mutual informa¬ 
tion and the infimum is taken over all noisy ‘squashing 
channels’ Se^e' taking the E system of a purification 
ABE of PAB to a system E' of arbitrary dimension. In 
related work, Tucci has defined a functional bearing some 
similarities to squashed entanglement [5SJ [22] . We can 
interpret Esq{A;B)p as quantifying the minimum rem¬ 
nant quantum correlations between A and B after an 
adversary possessing the purifying system E performs a 
quantum operation on it with the intent of ‘squashing 
down’ the correlations that A and B share. It should 
also be noted that among the many entanglement mea¬ 
sures, squashed entanglement is the only one known to 
satisfy all eight desirable properties that have arisen in 
the axiomatization of entanglement theory [21 [27H29] . 

Squashed entanglement of a quantum channel. 
The upper bound from [23] on the distillable key rate ap¬ 
plies to the scenario in which Alice and Bob share many 
copies of some bipartite state pab- In order to upper 
bound the key agreement capacity of a channel, we define 
the squashed entanglement of a quantum channel Na'^b 
as the maximum squashed entanglement that can be reg¬ 
istered between a sender and receiver with access to the 
input A' and output B of this channel, respectively: 

EsqiAf) = max EsqiA;B) (3) 

Waa' 

where p = pab = ■^A'^B{.\<j)){4’\AA')- Note that, in the 
above formula, we can take a maximum rather than a 
supremum if the input space is finite-dimensional because 
in this case, the input space is compact and the squashed 
entanglement measure is continuous |2Hj- Also, we can 
restrict the optimization to be taken over pure bipartite 
states, due to the convexity of squashed entanglement 
0 - 

We now prove that Esq{Af) plays an operational role 
analogous to intrinsic information, i.e., it upper bounds 
the secret-key agreement capacity P 2 {N). 

Theorem 1: Esq{Af) is an upper bound on P 2 {Af), the 
private capacity of JV assisted by unlimited forward and 
backward classical communication: 

P2(AA) < E,q{M). (4) 

Proof: First recall that the squashed entanglement is a 
secrecy monotone, that is, it does not increase under local 
operations and public classical communication (LOPC) 
in the sense that Esq{A-,B)p > Esq{A-,B)^ if Alice and 
Bob can obtain the state aAB from pab by LOPC [231 
[23] ■ The method for doing so was to exploit the fact that 
LOPC distillation of secret key is equivalent to LOCC 


distillation of private states [3ni[3i]- A private state has 
the following form [SO] [3T] : 

lABA'B’ = UaBA'B'{\^){^\aB ® PA'B')U\gg,, 

where Uaba'B' = J2ij \i){i\A®\3){j\B®U"l'B' is a global 
unitary operation, = Ei I*)aI*)b/v^ is a max¬ 

imally entangled state of Schmidt rank d, and {|i)A} 
and {|*)b} are complete orthonormal bases for quan¬ 
tum systems A and B, respectively. Furthermore, the 
squashed entanglement is normalized, in the sense that 
Esq{A-,B)^ > logd (see Proposition 4.19 of [23])- Fi¬ 
nally, the squashed entanglement satisfies the following 
continuity inequality [231HH] : 


if Upas - o-AB 111 < e, then 


Esq{A] B)^ 


Esq{A\ B)^ 


< lQ^/£ log d! + 4/12 (2 v^), 

(5) 


where d! = min{|A|, |i?|} and h 2 {x) is the binary entropy 
function with the property that lima,_io h 2 {x) = 0. 

The most general (n, R, e) protocol in this setting is 
described as follows, where n is the number of channel 
uses, R is the key generation rate (measured in secret 
key bits per channel use), and £ is a parameter quan¬ 
tifying the security (see below for their formal defini¬ 
tions). The protocol begins with Alice preparing a state 
Paai-"A„ ^^+1 systems. She then transmits the system 
Ai through one use of the channel Af, and considering 
its isometric extension we write the output 

state as (^^abxEiA^—a^- Fet R^^^ be a system that pu¬ 
rifies this state. There is then a round of an arbitrary 

amount of LOPC between Alice and Bob, resulting in a 
f2') 

state p\g g ^ . This procedure continues, with Al¬ 

ice transmitting system A 2 through the channel, leading 
to a state cr^BiBiBaBjAa-'-A ’ After the nth chan¬ 
nel use, the state is o’^abiEiB 2 E 2 ---b„e„ (note that the 
dimension of the system A might change throughout the 
protocol). Let R^'^'> be a reference system that purifies 
this state. There is a final round of LOPC, producing a 
state wabBi-'-b^j whose reduction wab satisfies 

||wAB - 7 ab|Ii < e, 

where 7 ab is a private state of nR bits. Note that we 
are implicitly including the systems A! and B' in A and 
B, respectively. 

We can now proceed by bounding the secret key gen¬ 
eration rate of any such protocol as follows: 


nR < Esq{A] B)^ 

< Esq{A;B)^+nf{e). 

The first inequality follows from the normalization of the 
squashed entanglement on private states (as mentioned 
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above). The second inequality follows from the continu¬ 
ity of squashed entanglement, with an appropriate choice 
of /(e) so that lime_>o /(e) = 0 (see the Methods section 
for more details). To continue, we introduce the following 
new subadditivity inequality for the squashed entangle¬ 
ment: 

Lemma 2: For any five-party pure state 
Esq{A] < Esq{AB2E2', Bi)^ -\- Esq{ABiEi] i?2)^- 

Proof: See the Supplementary Note 1 for a proof. 

With this new inequality in hand, we can establish the 
following chain of inequalities: 

£'sq(^; B)^ < i?sq(yl; Bl ■ ■ ■ i?n)cr(") 

< Esq{ABiEi ■ ■ ■ Bn-lEn-lR ^'^^; i?„)£r(") 

+ Esq{ABnEn': Bi ■ ■ ■ i?„_i)^(„) 

< Esq{Af) + Esq{ABnEn\ Bi ■ ■ ■ Bn-l)^(n) 

= Esq{Af) + Esq{AAn', Bl ■ ■ ■ Bn-1)pin) 

< nEsqiAf). 

The first inequality follows from monotonicity of the 
squashed entanglement under LOCC. The second in¬ 
equality is an application of the subadditivity inequal¬ 
ity in Lemma 2. The third inequality follows because 
Esq{ABiEi ■ ■ ■ Bn-iEn-iR^'^^; Bn)„M < EsqiAf) (there 
is a particular input to the nth channel, while the sys¬ 
tems ABiEi ■ ■ ■ Bn-iEn-iR^^'^ purify the system being 
input to the channel). The sole equality follows because 
the squashed entanglement is invariant under local isome¬ 
tries (the isometry here being the isometric extension of 
the channel). The last inequality follows by induction, 
i.e., repeating this procedure by using secrecy monotonic¬ 
ity and subadditivity, “peeling off’ one term at a time. 
Putting everything together, we arrive at 

nR < nEsq{M) + nf^e), 

which we can divide by n and take the limit as e —^ 0 to 
recover the result that P 2 (A/’) < EgqiN). This completes 
the proof of Theorem 1. 

It should be stressed that the right hand of Q is a 
‘single-letter’ expression, meaning that the expression is a 
function of a single channel use. This is in spite of the fact 
that the quantity serves as an upper bound on the secret 
key agreement capacity, which involves using the channel 
many independent times, entangled input states, and/or 
measurements over many channel outputs. Lemma 2 
is critical for establishing the ‘single-letterization.’ The 
simple expression in Q allows us to apply the bound to 
various channels, including the optical channel as shown 
below. 

Also, as mentioned in the introduction. Theorem 1 
states that Esq{Af) is a weak converse upper bound which 
bounds the key rate in the asymptotic limit of many chan¬ 
nel uses. However, our bound is also valid for any finite 


number of channel uses, in the sense that the key rate 
is upper bounded in terms of Esq{Af) and the reliability 
and security of the protocol. It might be possible to im¬ 
prove upon our upper bound, by establishing a so-called 
strong converse theorem (see, e.g., [5UI33]) or a refined 
second-order analysis, along the lines of [53] , which is left 
as an important open question. We point the reader to 
the Methods section for a quantitative discussion and an 
example scenario involving a pure-loss optical channel. 

A variation of this setting is one in which there is a for¬ 
ward quantum channel Af from Alice to Bob and a back¬ 
ward quantum channel A4 from Bob to Alice. The most 
general protocol for generating a shared secret will have 
Alice and Bob each prepare a state on n systems, Alice 
sending one system through the forward channel, them 
conducting a round of LOPC, Bob sending one of his sys¬ 
tems through the backward channel, them conducting a 
round of LOPC, etc. Using essentially the same proof 
technique as above, it follows that EsqiAf) -I- Esq{M) 
serves as an upper bound on the total rate at which Al¬ 
ice and Bob can generate a shared secret key using these 
two channels many independent times. It is also worth 
noting that Esq{Af) is an upper bound on the two-way as¬ 
sisted quantum capacity Q 2 {Af) (defined in [35]) because 
P 2 {Af) > <52(A/”) holds in general. 

Pure-loss optical channel. Now we are in a posi¬ 
tion to derive a limit on the key generation rate of any 
QKD protocol which uses a lossy optical channel. The 
following input-output relation models linear loss in the 
propagation of an optical mode, such as through a lossy 
fiber or free space: 

b = y/rja + i/l-Tje, 

where a, b, and e are bosonic mode operators correspond¬ 
ing to the sender Alice’s input, the receiver Bob’s output, 
and the environmental input, respectively. For the pure- 
loss bosonic channel, the environment mode is in its vac¬ 
uum state. The transmittance of the channel, rj G [0,1] 
is the fraction of input photons that makes it to the out¬ 
put on average. Let A// denote the channel from Alice 
to Bob. For a secret-key agreement protocol assisted by 
two-way classical-communication over this channel, we 
assume that it begins and ends with finite-dimensional 
states, but the processing between the first and final step 
can be conducted with infinite-dimensional systems (see 
the Methods section for further discussion of this point). 
Furthermore, as is common in bosonic channel analy¬ 
ses |36j . we begin by imposing a mean input power con¬ 
straint. That is, for each input mode, we require that 
(a^a) < Ns, with 0 < A^s < oo. Thus, Esq{Afr)), with 
the additional photon number constraint on the chan¬ 
nel input is an upper bound on P 2 (A//). By taking the 
squashing channel for the environment Eve to be another 
pure-loss bosonic channel of transmittance ryi S [ 0 , 1 ] 
(see Fig. [^, noting that the resulting conditional mu¬ 
tual information can be written as a sum of two condi- 
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Pure-loss channel 



FIG. 2: Setup for calculating the upper bound on the 
secret key rate of the pure-loss optical channel 


tional entropies, and applying the extremality of Gaus¬ 
sian states with respect to conditional entropies las! , we 
find that the following quantity serves as an upper bound 
on Esq{J\fjj) for all rji G [0,1] (see Supplementary Note 2 
for a detailed proof): 


5 5((i -m + vm)Ns) + giivi + - m))^s) 


- 5(f?r(l - v)Ns) - g{{l - gi){l - g)Ns) , 


( 6 ) 


where g{x) = (a: -|- 1) log 2 (a: + 1) — a:log 2 x is the Shan¬ 
non entropy of a geometric distribution with mean x. 
The function g{x) is also equal to the von Neumann en¬ 
tropy of a zero-mean circularly-symmetric thermal state 
with mean photon number x. Since the function in 
is symmetric and convex in r]i, its minimum occurs at 
rji = 1/2, leading to the following simpler upper bound: 

g{{l + g)Ns/2)-g{{l-g)Ns/2). 

By taking the limit of this upper bound as iVg —> oo, we 
obtain the photon-number independent expression, 

log2((l-k?7)/(l-??)), 

which recovers the upper bound stated in Q. 

As mentioned in the introduction, any excess noise in 
the channel can only reduce the squashed entanglement 
of a quantum channel and thus Q serves as a funda¬ 
mental upper limit on the secret key agreement capacity 
of a lossy optical channel. This statement follows from 
a quantum data processing argument, i.e., the quantum 
conditional mutual information does not increase under 
processing (including noise additions) of one of the sys¬ 
tems that is not the conditioning system (see Proposition 
3 of [2]). Note that the statement does not prohibit the 
improvement of the key rates by applying ‘noisy process¬ 
ing’ in specific existing QKD protocols such as BB84 as 
proposed in [311110]. However, such an improved key rate 
is always equal or lower than our bound in Q. 



FIG. 3: Upper and lower bounds on P 2 for a pure-loss 
bosonic channel. The magenta solid curve is the squashed 
entanglement upper bound in Q. The blue solid curve is the 
reverse coherent information lower bound. The black solid 
curve is the efficient BB84 protocol with perfect devices and 
single photons, and the gray dotted curve is the decoy BB84 
protocol including experimental imperfections |5]. The or¬ 
ange solid curve is the Gaussian modulated coherent state 
continuous variable protocol (GV-GG02) [9] with perfect de¬ 
vices. The brown dashed and pink dash-dotted curves are 
the GV-GG02 protocol including experimental imperfections 
with the uncalibrated- and calibrated-device scenarios, re¬ 
spectively. The details of the protocols and device parameters 
are described in the Methods section. 


Discussion 

It is instructive to compare our upper bound to the 
known lower bounds on the secret-key agreement capac¬ 
ity of optical QKD protocols. BB84 is the most widely 
examined QKD protocol. When operating under polar¬ 
ization encoding and ideal conditions over a lossy chan¬ 
nel (perfect single photon sources and detectors, and with 
the efficient BB84 protocol as proposed in m), and with 
no excess noise (i.e.. Eve can do only passive attacks con¬ 
sistent with the channel loss alone), the key rate is simply 
given by g/2 secret key bits per mode (SHU). The best 
known lower bound on the secret-key agreement capacity 
of the pure-loss channel A// was established in Ref. |32| : 

A 2 (A//) > log 2 (l/(l — r])) key bits per mode. (7) 

These lower bounds and our upper bound are compared 
in Fig. where we also plot the rate achievable with 
coherent-state continuous variable protocol (CV-GG02) 
Oi, another major protocol, without any excess noise 
or imperfections. Also, as examples of the practical per¬ 
formance of QKD, we plot the decoy-state BB84 proto¬ 
col including device imperfections as well as the imper¬ 
fect GV-GG02 with uncalibrated- and calibrated-device 
scenarios (see the Methods section for the details of the 
protocols and parameters). 

We note the following important observations. First, 
the two bounds in 0 and 0 become close for 77 <C 1 
(the high-loss regime, relevant for long-distance QKD). 
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Thus, for small r], our upper bound demonstrates that 
the protocol from [42] achieving the lower bound in Q 
is nearly optimal. To be precise, the upper and the lower 
bounds are well approximated by 2 ?;/ In 2 and 77 / In 2 key 
bits per mode, when 77 ^ 1 (see Fig.|^. Furthermore, the 
ideal BB84 rate (77 key bits per mode) is worse than the 
reverse coherent information lower bound, only by a con¬ 
stant ( 2 / ln 2 « 2 . 88 ) factor in the high-loss regime where 
the factor 2 reflects the fact that the BB84 uses two polar¬ 
ization (or other) modes to send one bit and In 2 reflects 
some kind of gap between the qubit and continuous vari¬ 
able protocols. On the other hand, the protocol described 
in [42] that attains the reverse coherent information rate, 
requires an ideal SPDC source, and collective quantum 
operations and measurements, structured realizations of 
which are not known. In addition, even with detector 
impairments, both the decoy-state BB84 as well as the 
CV-GG02 protocol (with or without the assumption of 
calibrated devices) can achieve secret key rates that scale 
linearly with the channel transmittance, until a maxi¬ 
mum channel loss threshold where the rate plummets to 
zero. For BB84, this loss value where the rate-cliff occurs 
is driven by the detector dark counts, whereas for CV- 
GG02, it is driven primarily by the electronic noise in 
Bob’s homodyne detector. Hence, given the comparisons 
shown in Fig. [^ and since BB84 and GV protocols are 
realizable with currently available resources, it does not 
seem very worthwhile to pursue alternative repeater-less 
QKD protocols for higher key generation rate over a lossy 
channel. 

Second, our bound significantly advances one of the 
long-standing open problems in quantum information 
theory, that of finding a good upper bound on P 2 (A^): as 
well as for the two-way assisted quantum capacity Q 2 {J^) 
(number of qubits that can be sent perfectly per use of a 
quantum channel with two-way classical-communication 
assistance). This is true for a general quantum chan¬ 
nel Af, and in particular for optical quantum channels 
such as Afrj. One of the important open questions is 
whether or not the true P 2 {Afn) is additive. In other 
words, the question is whether the protocol that attains 
P 2 {Afi)) requires an input state that is entangled over sev¬ 
eral channel uses, or if a product input state sufhces. In 
general, it is likely that P 2 {Af) is super-additive for some 
channel as is the case for the unassisted secret-key agree¬ 
ment capacity P{Af) [IS] and the classical capacity of 
quantum channels [44] . On the other hand, it is known 
that the classical capacity and the unassisted quantum 
capacity of the lossy optical (bosonic) channel are ad¬ 
ditive [SSI US]- As mentioned above, our upper bound 
on P 2 {N) is a single-letter expression for any channel, 
i.e., the input optimization to evaluate our upper bound 
needs to be performed over a single channel use. The 
lower bound 0 is the single-letter reverse coherent in¬ 
formation evaluated for the lossy bosonic channel, whose 
operational interpretation is an entanglement distribu¬ 


tion rate achievable via a product input realizable using 
a two-mode squeezed vacuum state, and collective quan¬ 
tum operations in the subsequent steps of the protocol, 
which uses classical feedback mi. Thus, despite the fact 
that the additivity question for P 2 {Afr]) remains open, 
any super-additive gain cannot be very large in the high 
loss regime, and P 2 {Afn) must scale as ^ 77, when 77 ^ 1 . 

As a final point, consider a two-way QKD proto¬ 
col, i.e., when Alice and Bob may use the lossy opti¬ 
cal channel A/), in both directions, and also communicate 
freely over a two-way public channel. In such a case, 
the secret-key agreement capacity is upper bounded by 
2 log 2 ((l + ??)/(l — ??)) secret key bits per mode transmit¬ 
ted in both directions. 

In summary, we have established in Q an upper bound 
on the rate at which any QKD protocol can generate a 
shared secret key over a point-to-point lossy optical chan¬ 
nel. This upper bound is a function of the channel loss 
only, and it does not increase with increasing transmit 
power. We compared our upper bound with the best 
known lower bound on the key rate and a key rate at¬ 
tainable in principle by the BB84 and CV-GG02 proto¬ 
cols under ideal operating conditions. This comparison 
reveals that there is essentially no scaling gap between 
the rates of known protocols and the ultimate secret-key 
agreement capacity, and thereby that there is no escaping 
the fundamental exponential decay of key rate with dis¬ 
tance. The result of this paper on the one hand provides 
a powerful new tool for upper bounding the private ca¬ 
pacity with two-way classical communication assistance, 
for a general quantum channel. On the other hand, the 
application to QKD over optical channels strongly sug¬ 
gests the need for quantum repeaters to perform QKD 
at high rates over long distances, no matter which actual 
QKD protocol one may choose to use. 

Some important open questions remain. Although our 
bound applies for any finite number of channel uses, one 
might be able to improve upon our result by establishing 
a strong converse theorem or even better by consider¬ 
ing a second-order analysis, along the lines discussed in 
[84] . For establishing a strong converse theorem, some 
combination of the ideas presented in [46| [47] might be 
helpful. Another important open question is whether our 
upper bound in 0 could be achievable using some QKD 
protocol, or whether the bound can be further tightened 
by choosing a squashing channel for Eve other than the 
pure-loss channel (as shown in Fig.0 or by investigating 
upper bounds other than EgqiN). For this last question, 
some recent results in classical information theory [151IT5] 
might be helpful. 

Methods 

Weak converse and the key rate upper bound 
for a finite number of channel uses. Although our 
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main result establishes only a weak converse theorem, 
it is possible to estimate the effect of a finite number 
of channel uses, which is always the case in any practical 
setting. We carefully estimate f{e) discussed in the proof 
of Theorem 1. From the continuity inequality in (§ , we 
can explicitly describe the additional term f{e): 

nR < nEsq{Af) + lei/elogd + 4:h2{2^/e), 
where d = 2”^. This implies the following bound: 

Y3^^r^(^sq(A/’) + 4/i2(2-\/£)/n). 


In the limit of large n, the second term 4:h2{2y/e)ln van¬ 
ishes and the upper bound becomes 


R < 


1 


{Esqm, 


which suggests that there might be room for a trade¬ 
off between communication rate and error probabil¬ 
ity/security as quantified by e. If one could establish 
a strong converse theorem, this would eliminate the im¬ 
plied trade-off given above, in the ideal case showing that 
the bound R < Esq{Af) would hold in the large n limit 
regardless of the value of e. 

Let us consider a quantitative example, consisting of 
a pure-loss channel with e = 10 “^° and n = 10 "^ (these 
are not too far from realistic QKD parameters ED- For 
these values, we get 


1/(1 - leVe) « 1.0002, (8) 

4 /i 2 ( 2 v^)/n « 1.36 x 10"^ (9) 

Furthermore, a 200km fiber with 0.2dBkm“^ corresponds 
to T] = 10“^ and log((l -I- ry)/(l — rj)) « 2.885 x 10“"^. 
Replacing Esq{Af) with our upper bound log((l + ? 7 )/(l — 
rj)) (see 0 ) and plugging in the above values of e and n, 
we find that 


R< 2.887 X 10-4, 

which is rather close to log((l + r])/{l — 77 )) « 2.885 x 
10-4. However, one can improve upon our upper bound 
by establishing a strong converse theorem or even better 
by providing a refined second-order analysis along the 
lines discussed in [Hi] . 

Infinite-dimensional system. An optical channel 
can transmit infinite-dimensional (i.e., continuous vari¬ 
able) quantum states while Theorem 1 implicitly assumes 
finite-dimensional systems. We can circumvent this sub¬ 
tlety by assuming the protocol between Alice and Bob be¬ 
gins and ends with finite-dimensional states, but the pro¬ 
cessing between the first and final step can be conducted 
with infinite-dimensional systems. That is, their objec¬ 
tive is to generate a maximally entangled state 
or a finite number of secret key bits, and they do so by 


Alice encoding a finite-dimensional quantum state into 
an infinite-dimensional system and the final step of the 
protocol has them truncate their systems to be of finite 
dimension. In this way, the continuity inequality in the 
proof of Theorem 1 safely applies and all of the other 
steps in between involve only the quantum data process¬ 
ing inequality, which has been proven to hold in the gen¬ 
eral infinite-dimensional setting |50| . 

Decoy state BB84 and CV-GG02 protocols with 
experimental imperfections. The asymptotic secret 
key rates of the decoy state BB84 protocol and the CV- 
GG02 in Fig. are calculated from the theoretical models 
including imperfections summarized in |5|. The param¬ 
eters used for the plots are as follows: For the decoy 
BB84, the visibility of interference at Bob’s receiver is 
0.99, the transmittance of Bob’s device is unity, the de¬ 
tector efficiency is 0 . 2 , dark count rate is 10 -®, and the 
information leakage parameter due to the practical er¬ 
ror code is set to be 1.2. For the CV-GG02 protocol, 
the optical noise is 0.005, the detector efficiency is 0.5, 
the electronic noise of the detector is 0 . 01 , and the effi¬ 
ciency of the error correction code is set to be 0.9. These 
parameters are chosen to reflect the state of the art de¬ 
vice technologies. In the ‘uncalibrated-device’ scenario. 
Eve is able to access Bob’s homodyne detector imper¬ 
fections, e.g. to entangle the loss and noise of the de¬ 
tector. The ‘calibrated-device’ scenario is based on the 
assumption that the homodyne detector is calibrated in 
a secure laboratory such that Eve cannot entangle her 
system to the detector imperfections. This assumption 
allows Alice and Bob to significantly extend the key rate 
and the loss tolerance. Note that the purpose of these 
plots is to compare these protocols under imperfections 
with our fundamental upper bound but is not to com¬ 
pare the practical aspects between these protocols (for 
example, our model does not include important practical 
conditions such as phase stability, repetition rate of the 
system, actual coding strategies, etc). For completeness, 
the key rate formulae for each protocol and scenario are 
described in Supplementary Note 3. 
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SUPPLEMENTARY NOTE 1: PROOF OF THE SUBADDITIVITY INEQUALITY (LEMMA 2) 

Let us restate the statement of the lemma: For any five-party pure state V'aBiBiB 2 -E 2 > the following subadditivity 
inequality holds 

Esq{A; BiB 2)^ < Esq{AB2E2': Bl)^ + Esq{ABlEi; B2)^. 

Proof. Let 


TABiE[B2E2 = (V'ABiBiB 2 B 2 )) 

0’ABiBiB2B' = ‘5e2-)-E'(■*/'ABiBiB2B2)! 

WaBiB(B 2B' = ® )(t/’ABiBiB2B2)i 

where each Se^^e'- is an arbitrary local squashing channel. Let \(IA’)ab^e' B 2 E' r ^ purification of w with purifying 
system R. The inequality in Lemma 2 is a consequence of the following chain of inequalities: 

2E,^{A-BiB2)^ < I{A-BiB2\E[E'^)^ 

= H{B^B2\E[E'^)^ - H{B^B2\E[E'^A)^ 

= H{B^B2\E[E'^)^ + H(B^B2\R)^ 

< H{B,\E[)^ + H{B2\E'^)^ 

+ H{B,\R)^ + H{B2\R)^ 

= H{B,\E[)^- H{BMB2E[E'^)^ 

+ H{B2\E!2)^-H{B2\AB,E[E'^)^ 

= I{AB2E!2;B,\E[)^+I{AB,E[-,B2\E!2)^ 

< I{AB2E2-, B^\E[)^ + /(ABiFli; B 2 IF;'),. 

The first inequality follows from the definition in (2). The first equality is a rewriting of the conditional mutual 
information. The second equality exploits duality of conditional entropy: for any pure tripartite state on systems 
KLM, the equality H{K\L) + H{K\M) — 0 holds. The second inequality results from several applications of strong 
subadditivity (SSA) of quantum entropy (SSA is the statement that I{K-,L\M) > 0 for an arbitrary state on systems 
KLM) p. The third equality again exploits duality of conditional entropy and the last equality is just a rewriting in 
terms of conditional mutual informations. The final inequality is a result of a quantum data processing inequality for 
conditional mutual information (see the proof of Proposition 3 of m)- Since the calculation above is independent of 
the choice of the maps Se^^eu the system Ei purifies the state on AB 1 B 2 E 2 , and the system E 2 purifies the state 
on AB 1 B 2 E 1 , the subadditivity inequality in the statement of the theorem follows. ■ 


SUPPLEMENTARY NOTE 2: SQUASHED ENTANGLEMENT UPPER BOUND FOR THE PURE-LOSS 

BOSONIC CHANNEL 

Here we detail a proof that (5) is an upper bound on F 2 (A/’r,), where A/”,, is a pure-loss bosonic channel with 
transmittance rj G [0,1]. 

As mentioned before, we need to consider only pure states \4>)aa' when optimizing the squashed entanglement of 
a quantum channel. Let Ue^e'f he an isometric extension of Eve’s squashing channel Se^e'- Let \4’)abe'f = 
Ue^e'fBa'^beI'P)AA'’ that, Tt:e[\4’){4>\abe'f] = Se^e' o U^i^ee{4’aa')- Then 

sup Esq(A; 

4>aa' 

= sup i inf I{A-,B\E') 

4‘aa' ^ 

= sup I inf {H{B\E% - H{B\AE%) 

<I>AA' ^ ^E^E' 

= sup i inf {El{B\E% + H{B\F)^). 

4>aa’ ^ 


(10) 
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The first equality follows from the definition of the squashed entanglement. The second equality follows from the 
definition of conditional quantum mutual information. The third equality uses the duality of conditional entropy and 
the fact that |' 0 ) is pure. 

Now suppose that Alice and Bob are connected by a pure-loss bosonic channel with transmittance tj. It is not 
necessarily an easy task to optimize Eve’s squashing channel S. Instead, we consider a specific squashing channel: a 
pure-loss bosonic channel with transmittance rji. As shown above, the squashed entanglement can be written as a 
sum of two conditional entropies, each of which is a function of the reduced state Tt:a{4>aa'} on A'. Since the overall 
channel from A' to BE' is Gaussian and the overall channel from A' to BE is Gaussian and due to the photon-number 
constraint at the input, it follows from the extremality of Gaussian states for conditional entropy nil] that a thermal 
state on A! of mean photon number A’g maximizes both of these quantities. With this and the fact that (fiAA' is a 
pure state, we can conclude that the optimal (j)AA’ is a two-mode squeezed vacuum (TMSV) state. Let Ng be the 
average photon number of one share of the TMSV. Then the covariance matrix of the reduced thermal state at A! is 
given by 

l + 2Ns 0 
0 l + 2Ns ’ 



Note that the covariance matrix is defined such that a vacuum state (or coherent state) is described by an identity 
matrix. Therefore a covariance matrix of the initial state in system A'E'E is given by 0 /^ 0 /^. The beamsplitting 
operations are given by the transformation 


7^' 0 0 ^ Sr„Sr, ( 7 ^' © , 



\ Vv 


o' 

02 


■ I 

0 

0 

Sr,= 

-VI- 

V Vv 

0 

5 

SrA = 

0 

v^ 

VI - m 


0 

0 

1 



0 

-VI - m 

v^ 


(the superscript “02” means that the same matrix is applied to both x and p quadratures. Because of the symmetry 
of the state and the beamsplitter operation in phase space, basically we need to consider only one quadrature.) This 
transformation is easily calculated and we get a covariance matrix for the state Tta{\(I)){(I>\abe'f}' 




1 0 r]2Ns 
- r ])y/m2 Ns 
\/??(l - 77)^1 - ??i 2 iVs 


-V’7(l - ??)V^2Vs 
1 0 (1 - r,)m2Ns 
(1 - - ?7i)2A^S 


- r] )^l - 7?i2V g 

-(1 - 

l 0 (I- 7 ?)(l-r;i) 2 iVs . 


It immediately implies a covariance matrix of the marginal state on E': 

^ r 10 (1 - p)m‘2Ns 0 

[ 0 I 0 (1 - 77 )? 7 i 2 Vs J ’ 

which is the covariance matrix for a thermal state with photon number (1 — r])r]iNs. Thus we have 


H{E') = 5((1 - r])r]iNs), 


where g{x) = (1 0 x) log(l + x) — xlogx. Similarly, we get 

H{F) = 5((1 - 77)(1 - t]i)Ns). 

The other entropies E[{BE') and El {BE) are also obtained by considering the corresponding submatrices and diago¬ 
nalizing them. Then we can find 

H{BE') = g{{r] 0 (I - v)vi}Ns) 

H{BE)=g{{g + il-r,){l-g,)}Ns) (II) 


As a consequence, we obtain the upper bound, 

P2{AJ'-n) < min i{g ({?7 0 (I - r])gi}Ns) - g{{l - v)mNs) + 9{{v + (1 - v){^ - m)}Ns) - ff((l - v){l - Vi)Ns)} 

= g{{l + g)Ns/2)-g{{l-g)Ns/2). (12) 

The minimal value is achieved by 71 = 1 /2 because the function is symmetric and convex in pi (with convexity checked 
by computing the second derivative). The expression ^((1 0 p)Ns/2) — g{{l — p)Ns/2) converges to log(1 0 ? 7 )/(l — 77 ) 
as Ns -A 00 . 
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SUPPLEMENTARY NOTE 3: SECRET KEY RATES FOR THE DECOY BB84 AND CV-GG02 

PROTOCOLS 

In this supplementary note, we describe the asymptotic key rate formulae for the decoy BB84 and Gaussian 
modulated coherent-state CV-GG02 protocols. Detailed description of the protocols and the derivation of their key 
rates are for example found in [S] and references therein. Note that we only consider the asymptotic limit, that is, 
the channel estimation is perfectly done by negligibly small amount of pulses. 

Decoy BB84 protocol. Let ^ be the mean photon number of the pulse which is tunable to generate decoy states. 
For each the key rate is given by 


= 


+ Y«(l - h{ei) - leakEc(Q«)}. 


(13) 


We can assume that a given value /r is almost always used for Thus in the following we only consider ^ and then 


optimize /r to maximize the key rate in Eq. (13). The parameters in the rhs of Eq. (13) are as follows: R is the total 


detection rate (here it is given by the rate per mode per pulse. Note that the deocy BB84 usually uses two modes, 
such as polarization or time bins, to send one bit of quantum information), Y„ = Rn/R where is the detection 
rate for the events when Alice sent n photons (^,^ = R and thus ^ = 1 )j Cn is the error rate on the n photon 

signal, h{-) is the binary entropy function, Q is the quantum bit error rate (QBER), and leakEc(Q^) = fh{Q) and 
/ > 1 represents the efficiency of the error correction code. For the decoy BB84 protocol, these terms are given by 


= (l_e-/^‘(l-2pd))(l-Pd)/2, 
^ 2pde~^ 

0 i_ 2pde“'"* ’ 

^ Me~^(t(l - Pd) + 2(1 - t)pd) 

^ 1 - (1 - 2pd)e-^‘ 

_ fe -b (1 - t)pd 
t + 2(1 - t)pd 
^ e- (e-Pd)e-^* 

^ 1 - (1 - 2pd)e-t^^ 


(14) 

(15) 

(16) 

(17) 

(18) 


where t = rjpBVd, V is the channel transmittance, pB is the efficiency of Bob’s devices, pd is the efficiency of Bob’s 
detectors, pd is the dark counts of the detector, and e = (1 — U)/2 with the visibility V. The optimal key rate is then 
given by 


^opt°^ = maxAT'". (19) 

CV-GG02 protocol. The key rate is given by 

K = R[^IiA;B)-x{B;E)], (20) 

where R is the repetition rate, which is omitted in our calculation, (3 is the reconciliation efficiency, I{A;B) is the 
mutual information between Alice and Bob, and x{B\E) is the Holevo information between Bob and Eve. In the 
following we consider the uncalibrated- and calibrated-device scenarios. For both scenarios, I{A\B) has the same 
expression: 

I[A-B) = \\ogJj^y ( 21 ) 

where u = + 1 is the variance of the Alice’s output thermal state and va is the variance of the Alice’s Gaussian 

modulation. 5 is the total noise between Alice and Bob: 

5 = 5cd + 5d/p, ( 22 ) 

where dch = (1 — » 7)/?7 -b e is the channel noise with the channel tarnsmittance p and the optical excess noise e, and 

i5h = (1 -b Ve\)/pd — 1 is the noise of the Bob’s homodyne detector with the homodyne detector’s electronic noise Uei 

and quantum efficiency pd- 
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The amount of the Holevo information depends on the scenario. For the uncalibrated-device scenario, Eve can hold 
a whole environmental part including the loss and noise of the homodyne detector at Bob’s side. Then the Holevo 
information is calculated to be [5] 


where Xk = {Xk - l)/2, 


and 


Xuc{B', E) — g{Xi) + g{X 2 ) — 5 (^ 3 )) 
^1,2 = 2 , 

2 _ u(l + u(5) 


A = u^(l - 277?7d) + 27?77d + {7777d(u + 5)}^, 
B = {ggdivS + 1)}'^. 


(23) 


(24) 

(25) 

(26) 
(27) 


The achievable key rate is then obtained by maximizing K over u > 1. 

For the calibrated-device scenario, Eve cannot access to the homodyne detector’s imperfections. The Holevo 
information for such a scenario is for example given in [^. We summarize it here for the completeness: 


where AJ, = (A), - l)/2. 


and 


:e(H; E) = g{X[) + g{X'^) - ^(A') - g{X!^), 

(28) 

X'l^ = i(A'± v/a1'2-4H'), 

(29) 

A'^d = \(C' ±^C'^-AD'), 

(30) 

A' = v^{l-2r]) + 2g + {g{v + 5c\,)}^, 

(31) 

B' = {^{vSch + 1)}^, 

(32) 

_ V^/IE + T]{v + 6ch) + A'5\, 

(33) 

ri{v + 6) 


v^/W + B'Sl, 

1341 

V{v + 5) ’ 



The achievable key rate is again obtained by maximizing K over u > 1. 
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